6c2dee1494b8d8ca09163a1fd87be156defc3884101e6dfe23267829d0e6b758

Sharing

Copy URL Twitter E-mail

General

Target
SpotX-main.zip
Size 112KB
Sample240224-sdfkksfa79
SHA256 6c2dee1494b8d8ca09163a1fd87be156defc3884101e6dfe23267829d0e6b758
MD5 199e8645060805dc82f8915a9d920979
SHA1 ca0c21b4cfa4d541bce2c49a33b97ea2ab40fa0f
SHA512 9ea0403f6e0bd0ac7299274df184a9c45ffbb3e174abb0cffd97fc6d1301a226f8e93a05e244d5cc9afbefe8ee6396573ff1a8a0cea60b95ccdab909e08d8ee0
SSDEEP 3072:FrG7WyvOibl6LjQzaupo4G4xzAlYVodLws:4TOih6LkzauPnMlPLws
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery

Malware Config

Targets

- Target
  SpotX-main/.github/ISSUE_TEMPLATE/bug_report.yml
- Size 2KB
- SHA256 d174f6be612353f3946421b3b279600709d2df4be7e5bf1cf07717b1e16b497d
- MD5 822a4d2f869b13d9379cf20ae07fcbbb
- SHA1 69e2f2b55cfde77718ab596a7aeae5c789ba5f63
- SHA512 8997c87d9315ec84af1c6fb132154e0d2f372a6470cfebc067ecffab598df6d88a88688fe037f89ce3c2c2f93f113ae72665ea8dc019545857dc1520c97c565e
- MD5 SHA1 SHA512
Score

6^/10
- Drops desktop.ini file(s)
behavioral1 behavioral2
- Target
  SpotX-main/Install_New_theme.bat
- Size 277B
- SHA256 fa7ff9975dce1fc26987f6457ee9ef5e9a9fbe4d21b68a34941343f5cb00651e
- MD5 bf78a0583ee16de7cf3776c7c7ad23fc
- SHA1 30d6cf358f8932007554e5a5ef2f3ccf83c90e8a
- SHA512 8a154d83996fbf0ba5f3c13514c48484824238d5d42aa7bcb44e399b996c249b66edaf722080101db0a7b4e8b93ca6028ac27ef565b9dfc7169d62466cf8f5ab
- MD5 SHA1 SHA512
Score

8^/10

discovery
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
behavioral3 behavioral4
- Target
  SpotX-main/Install_Old_theme.bat
- Size 343B
- SHA256 df31bf50d5b155b1ba8150cb2cb446a20d299ed8d44c842a152def14ba1c715d
- MD5 de98e6429eb645242319b15137585767
- SHA1 a7307241c517de2998a34df67c8ce9c293041c11
- SHA512 523ea234877f032ce0fb33d11e804f46cd8015b7248fe3c050953e11ede56cfbcf965cfe630a1dc34e741eabbac3d97e3183c227c4695b13887de85b33322966
- MD5 SHA1 SHA512
Score

8^/10

discovery
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
behavioral5 behavioral6
- Target
  SpotX-main/Uninstall.bat
- Size 940B
- SHA256 98fe8b9857375588722d2d2a325af6c998e8ad93f87ec84c2a409c21979d0210
- MD5 b74fc1987d231ff335f8a82dab4c040f
- SHA1 d6e0cb07fa605352377ac38aa3d7bebe25f2d13f
- SHA512 75cc13c7efe2f126bc8dea5765b997c480a5d565ffc2b7f626bdcdbf0eaf7f2d62e30b7d3e6107db935bf3a16494f04176419f10e986de8f0c181e431aba8a19
- MD5 SHA1 SHA512
Score

1^/10
behavioral7 behavioral8
- Target
  SpotX-main/patches/patches.json
- Size 59KB
- SHA256 b8c9798730f87c96aad746c61269a4b9ff62116074e84643fcdbde4836ef6779
- MD5 41182ce5413d86306ddcd061a657e162
- SHA1 88b49399e8ea9aaa2114cdcf3bf9a16c7724a9ab
- SHA512 148b90ab723e26af07164ae7016e2d5830cb7e9d17ee3652679070b8c95e13a9bad82ca6e2d23a5d20433edc3a17ca0f4f29da22f7ec8076602bdb0d56363910
- SSDEEP 768:tlkXNt+vBFW53TN+rHPz6gKYYVyKkoHfRXlQChxpOt0kVjorqBUpwfNRrCjh3ZPG:G5BxpBnv8onFxo/
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  SpotX-main/run.ps1
- Size 56KB
- SHA256 aaa6c32a850c174894956f9b80439245fa9e23f80a81b9ea5dd37c8d04e068b9
- MD5 91b092a5b5cd3539f1230936fdf233fd
- SHA1 a473a60c82a175d51f0b679636b5032fe7abde03
- SHA512 0861021f2bfbe3a71dd9de0d7664a51b75a7104702ad7fa5503cb0357e0ab8f0d95bf4509565cfaa8979323e4b86c23de9b3803066a63a25331c4dc7195626df
- SSDEEP 768:Uc/QRmZdvKRgo+KIwwrFK5cHM4pPIZk13EA6Hm1AE0dj15H6TwNR7daxPDQD/:LQRmC7A3uTvW87
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

discovery
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral11 behavioral12
- Target
  SpotX-main/scripts/Install_Auto.bat
- Size 417B
- SHA256 7bff21f11b90894348a2b9e4469b7c0c3f5d24217c1200cc4dda55905025bdcd
- MD5 54b03a0ff44958963dea1a0784d0cd3a
- SHA1 bd83e2aca448d4d8bd4c7cb114a89a4dfb0e5fe8
- SHA512 18ecc4b3402a5b58098d62e917d9501298394e4d26b19a4a242d1562717f22d8baf4553cb4d71ac0326c75798239d9c026a5911e6cc2a778da476deb78b95a1c
- MD5 SHA1 SHA512
Score

1^/10
behavioral13 behavioral14
- Target
  SpotX-main/scripts/Install_Prem.bat
- Size 286B
- SHA256 2c91cca4dadcf7b1ade3f6458bc2a92f520ee48980e3ed26b005049bdd5b9910
- MD5 d3104124d9e47b95472ec43b4fa31b93
- SHA1 3adf726eadbd415f9747bce0eedd3dad5842819d
- SHA512 172ecf7d4833b51225db9d71bfe43241aa17814a1b977c2abf03aedaebb1dd5fb959345d2ebcae4b77177a2f3cc44e1945357c5067d98e24a2afba7322b2a0bc
- MD5 SHA1 SHA512
Score

8^/10

discovery
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
behavioral15 behavioral16
- Target
  SpotX-main/scripts/installer-lang/bn.ps1
- Size 7KB
- SHA256 98b0e630490610acea1e91a6c3980735afd351e7d4765b24ea2a8965cf70dcf0
- MD5 7ff5b63c358646e7b271e18830f9477a
- SHA1 2b78acec263c3dea3599194c393832d331515807
- SHA512 8d61492a88d04fc4ce14513c4941d84907facc78d30b3c1582d6e23bf10a01344f99c83c4561806f717202e9025960620afa7c6af54a5cd5f16f21459714b664
- SSDEEP 192:zF0qcvu5uZxhqYkDzC+FRKV2wmUDE+j208g:zF0qcvu5uZxhqYkDzC+fTUDEI2m
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  SpotX-main/scripts/installer-lang/de.ps1
- Size 4KB
- SHA256 9fcc99f3865a44efa51505d997e5dc58a7a8d1edf8f66325e9b88b3b847d5943
- MD5 f7f1492ad0c41957df8b26b39103618c
- SHA1 d1436ed5bddffb2619eca33c9c4465735dfdcdf8
- SHA512 bea18483e99222ecec3dae098e6aef3bd5ca98c50c72073c6ca34b38e0bf0a576a7ab84af1737042ee9efbf8468b9a5d298984101ceab0798b7d87d1da13ba5a
- SSDEEP 48:2L9fPpuy/osNUTFSuZQA3SuGHr1+QGYeQt19P//V9vqARhZVwhU3bh85S694M6sL:2BQXgyZ1F3ONrvlTZVIU3O5zLHgAIC
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  SpotX-main/scripts/installer-lang/el.ps1
- Size 5KB
- SHA256 796e6527f14baaa39ddb4a4652a909fde0c73f8b918b4a726c8e4cc305b1badb
- MD5 b511c932a78e9d07a0e07d239cae2d30
- SHA1 edf2e644300fd12111a3a58f1daa88d655531f19
- SHA512 685d33faa7857b06b92619793df64ed5e1fca5905c5f6e47295ce3155d699a4169ad4dac6ee1056bf54bc0834faef7cba63ff3f5c062f3f8ca0aef8061439e8a
- SSDEEP 96:Ke/wgqAuW5UjxAEst+VKIENTI17tewxDVDnxrwSLqfavLsvk5xURgaq0:rw5AFUWt2Kxklt1beIRvovk5xURlb
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  SpotX-main/scripts/installer-lang/en.ps1
- Size 3KB
- SHA256 e5fa948b37b2589912b80f1732385d0e677e15e0bcade69adcef9c6547052c9c
- MD5 d67f569da5c55d82aa66ddaa91e62e72
- SHA1 0cc78b9c48e50dd313d727043cdbc2ee053768aa
- SHA512 64daad1bce7f3fe4fe3f9ef0d27bc30038c01d51f9f4e14c73cf09d459a5e1a28ac7aca54c5dfda246cd3143436c68752a68e9e69ffd525643e511d2360b2987
- MD5 SHA1 SHA512
Score

1^/10
behavioral23 behavioral24
- Target
  SpotX-main/scripts/installer-lang/es.ps1
- Size 3KB
- SHA256 3caf44d54d5b6381c66ba3d2cb3a6779db575a4dd14a32fce9870b3c40ee4fd0
- MD5 0ce9e6a5b54994f0e51a4f1e8e5be71c
- SHA1 167cd189359fbdc0553520d1b0243bc8190fffcf
- SHA512 598a9e8124affc8fc9a66921083cadf9b757dde9abc833644a15e1a0ad72a176484b367b5517383fbab8bc06c1c7e28be677641e42567e8c237c20bcf1a445f1
- MD5 SHA1 SHA512
Score

1^/10
behavioral25 behavioral26
- Target
  SpotX-main/scripts/installer-lang/fa.ps1
- Size 4KB
- SHA256 8f71946477d255d5e6667802ba689140ded7a1e711baf5e4d272a3ea7b2d2852
- MD5 3a1c90a2b892d683f221a19c9e225928
- SHA1 3cf8dc0af292a61ec258b3e0f0aa78b84f7ed991
- SHA512 7d5ce669b64f863c56cd8f2157befc5e0b1508a8f9cebf5bf16030e43497184a7e1e2f2c52156ce2b6a42a0eac76eba1043480be3f2b5641ed067a51646701bd
- SSDEEP 96:QWgIVtIRIXerkOP7sdLfbrb55UA7nTKe2JUrpq2ZecdX7U:dbqJ7oPn7rLvLU
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27 behavioral28
- Target
  SpotX-main/scripts/installer-lang/fi.ps1
- Size 3KB
- SHA256 c2b569c863120b49ca146db0e2ee0ad320a47d324749682e3c4b2e33f5050e6b
- MD5 fa49d546feba873879fbe0653709a68c
- SHA1 22841cde66fd3a45272bd16c64584d282e3ad077
- SHA512 5811ee854eb7bc2869b374b45abe5a3f7a97c41c8314ac634f5b5f1bc541fd38fbf16db731261cdf5f1c177cf4622dee05419de8a754c5cc794f770e21721705
- MD5 SHA1 SHA512
Score

1^/10
behavioral29 behavioral30
- Target
  SpotX-main/scripts/installer-lang/fil.ps1
- Size 4KB
- SHA256 655137cd527ad0da1493f2c78f0daf405784b0a007b769a655adfd2acd15b10a
- MD5 5e13254de1f6267650c1ee3728d9db56
- SHA1 d23a9a9685d88409691ff7bfef1e4ead8d9b7cfd
- SHA512 15ff10616bf0faa37f2df86399dde498105190a7ea6540234c42a0a9731d3e3d9f4c7eb97ccda5d4a7ceced7f369cd92ac8555e8af2316658526acd9301f9e1f
- SSDEEP 96:GcIZzZTUYk3f4QJw5OR77E4syqwk08RQ8pH:i12YRQHR/7syhk08RQcH
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops desktop.ini file(s)

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32